One of the 2 intermediate CA on your cert path is signed with SHA-1: VeriSign Class 3 Public Primary Certification Authority - G5 In addition, in my Chrom

One of the 2 intermediate CA on your cert path is signed with SHA-1: VeriSign Class 3 Public Primary Certification Authority - G5 In addition, in my Chrome for Linux browser (Version 41.0.2272.101 (64-bit)), that cert's parent cert is: Class 3 Public Primary Certification Authority And that's a 1024 bit RSA key. So my chrome's validation path includes a signature by a 1024 bits RSA key using SHA-1 as a trust step. No EV for you. Had the G5 cert been in my trust store (might be on your platform) then all the signatures would have been from 2048-bits RSA keys with SHA-256 and all A-OK.